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REMARKS/ARGUMENTS 

Claims 1-20 have been resubmitted. Claims 1, 6, 10, 15, 17, and 19 
have been amended. Claims 4, 5, 8, 9, 16, 18, 20, and 21 have been 
cancelled. 

In the Office Action, the Claims 1-5, 11, 12, 15, 17, and 18 were rejected 
under 35 U.S.C. 101 as being directed to non-statutory subject matter. Claims 
6, 8-10, 13-14, 16 and 19-20 were rejected under 35 U.S.C. 103(a) as being 
unpatentable over by Damiani et al. in view of Deo. Claims 1-5, 7, 11-12, 15 
and 17-18 were rejected under 35 U.S.C. 103(a) as being unpatentable over 
Damiani in view of Deo and Murata. Claim 21 was rejected under 35 U.S.C. 
103(a) as being unpatentable over Damiani, Deo, and Hunnicutt. 

Rejections under 35 U.S.C. 101 

Claims 1-5, 11, 12, 15, 17, and 18 were rejected under 35 U.S.C. 101 as 
being directed to non-statutory subject matter. In particular, the Examiner 
stated that the claimed "logic operation unit" is directed toward non-statutory 
subject matter and is "at best, functional] (sic) descriptive material per se." 
Applicants disagree that a logic operation unit is non-statutory subject matter. 
Nevertheless, Applicants have amended Claim 1 to include the following 
limitations: 

" , wherein said path expression is extracted from a received query requesting 
access to said database " 



" , said logic operation unit issuing a decision which allows access, or does not 
allow access, to said data in response to said guery ." 
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Accordingly, Claim 1 , and claims 2-5 dependent thereon, now recite the 
necessary physical structure (database), and interaction and physical 
transformations (e.g. receiving a query, and issuing a decision allowing access 
to the database) to render the claim statutory under 35 USC 1 01 . 

Claim 11 is dependent on Claim 10, which is clearly statutory, since it 
includes such elements as a "database retrieval system" and "a database". 
The addition of a "logic operation unit", even if it were a non-statutory element, 
does not render the otherwise statutory claim non-statutory. For example, 
MPEP 2106.01 (I) states: 

USPTO personnel should determine whether the computer program is 
being claimed as part of an otherwise statutory manufacture or machine. In 
such a case, the claim remains statutory irrespective of the fact that a computer 
program is included in the claim. 

Hence, the addition of a allegedly non-statutory "logic operation unit" to Claim 
1 1 does not render the otherwise statutory claim non-statutory. Hence, Claim 
1 1 and Claim 1 2, dependent thereon, meet the requirements of 35 USC 101 . 

Claim 15 already contained statutory elements including "predetermined 
storage means". Nevertheless Applicants have amended this claim to further 
recite: 

" , the path expression being derived from a received query " 

" , and issuing a decision allowing access or not allowing access to said 
database " 

These steps involve interaction with physical elements. Hence, Claim 15 now 
recites the necessary statutory elements as a whole to meet the requirements of 
35 USSC 101. 
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Claim 1 7 has been amended to recite: 

"A computer readable medium encoded with a computer program. . ." 

According to MPEP 2106.01 (I), citing In re Lowry 32 F.3d 1579 (Fed. Cir. 
1994), such a claim is statutory. Hence, Claim 17, and Claim 18 dependent 
thereon, meet the requirements of 35 USC 101. 

Rejections under 35 U.S.C. 103(a) 

Claims 6, 8-10, 13-14, 16, and 19-20 were rejected under 35 U.S.C. 
102(a) as being anticipated by Damiani in view of Deo. 

The Damiani Reference 

The Examiner has cited the article entitled "A Fine-grained Access 
Control System for XML Documents", dated May 2002, (hereinafter "Damiani") 
in rejecting the claims. 

Damiani, at page 169, discusses two categories of access control 
systems for XML documents. In describing the first category Damiani states: 

"However, these approaches typically operate at the 
file-system level, independently of the data that 
have to be protected from unauthorized accesses ." 
(see Damiani at p. 169, emphasis added) 

Damiani then proceeds to discuss problems with this approach. 
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The second category of access control system is the kind advocated and 
disclosed by Damiani in the rest of the paper. It is described as: 

"We present an access control model to protect 
information distributed on the Web that, by exploiting 
XML's own capabilities, allows the definition and 
enforcement of access restrictions directly on the 
structure and content of the documents ." (See Damiani 
at p. 169, emphasis added) 

The fact that the Damiani system operates on the structure and contents of the 
documents to be accessed is further illustrated by Figure 1 1 in Damiani, which 
clearly shows that the XML document (for which access is requested) is 
accessed and parsed. "Parsing" is the first of the three main steps in the 
Damiani system, the other two steps being "compute view" and "unparsing" as 
described on page 198-199 of Damiani. In particular, on page 198 Damiani 
states: 

"The parsing step consists of the syntax check of the 
requested document... ." 

The result of the parsing is an object-oriented document graph which is used in 
the next two steps to make the access determination in response to a request. 

Thus, it is clear that Damiani teaches an access control system that 
accesses the documents for which access is requested. Damiani performs an 
analysis by checking the structure of the XML document to be accessed. 
Damiani teaches away from the first type of access control system discussed 
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above, which operates at the file-system level, independent of the data that is 
being protected. 

Applicants' invention is clearly of the first type. It operates independently 
of the data that is being protected. In particular, Applicants' invention performs 
a preliminary access decision prior to an actual analysis being performed by 
checking a structure of an XML document. It does this by analyzing a path 
expression (extracted from a received query) in which a retrieval condition is 
described using an access control policy indicting an access condition. (See 
Applicants' specification at page 9, lines 10-24). 

The access analysis performed by Applicants' invention is considered 
preliminary for the following reason. In cases where this analysis yields a 
decision in which the retrieval condition is always permitted or always denied, 
the access analysis is complete. However, there is also the possibility that the 
analysis indicates that the propriety of the access is indeterminate. In this case, 
a conventional access analysis must be performed by checking the structure of 
the XML document to be accessed. (See Applicants' specification at page 26, 
lines 6-16). 

An important advantage of applicants' invention is that the speed of the 
access decision process is increased because at least in those cases where a 
yes or no decision can be made, the time consuming process of retrieving the 
XML document is avoided. Only where the preliminary decision is 
indeterminate must the XML document be retrieved. In prior systems such as 
Damiani, retrieval of the XML document was needed in each case, resulting in 
slower performance. 

The Deo Reference 
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The Deo reference makes an access decision prior to accessing the 
requested document. However, it does this by merely looking up the identity of 
the requestor in a look-up table. In particular, Deo says at col. 4 lines 37-39. 

"The file system 118 includes an ACL (access control list) table 204 that 
performs the security function of determining which users and/or applications 
have access to which files. " 

Hence, The Deo reference therefore presupposes that the requesting "user 
and/or application" is specifically listed in a look up table. However, the cited 
references do not teach how to make the authorization decision if such a lookup 
table were not available, or if the requestor were not listed in the table. 
Applicants' invention makes authorization decisions without any reference to 
such a look-up table explicitly containing the identity of the requestor. Instead, 
Applicants' invention makes the authorization decision merely by analyzing the 
query itself, without checking the identity of the requestor in a look-up table, as 
taught by Deo, and without retrieving the requested document. 

Regarding claim 6, applicants have amended this claim to include the 
limitations of Claims 8 and 9. Thus claim 6 recites that a path expression is 
extracted from a query (from previous claim 8) and that access rights are 
decided based on this path expression. In contrast, Deo relies on a look up 
table, and Damiani relies on accessing the requested file. Neither reference 
singly, or in combination, teach or suggest a way to make access decisions 
based on information from the query itself without accessing the requested 
document or checking the identity of the requestor in a lookup table. 

For these reasons Applicants respectfully submit that Claim 6 is not 
rendered obvious by Damiani in view of Deo. 
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Regarding Claim 10, this Claim has been amended to recite: 

"...said preliminary access rights analysis device deciding said access rights 
without retrieving said XML document if said access right is always permitted or 
always denied, and only where said access right is indeterminate, said 
database retrieval system accessing said XML document to determine an 
access right . " 

Support for this amendment may be found at Applicants' specification at page 9, 
lines 16-18. Applicants disagree with the Examiner's position that Damiani 
includes an access decision of "intermediate" within the meaning of Applicants' 
claims. Nevertheless, Damiani does not teach the amended feature that the 
XML document be accessed only in the case of an "indeterminate" 
determination. Hence, Claim 10 and Claims 13 and 14, dependent thereon, 
are patentable. 

Claim 19 has been amended to include the limitations of Claim 20. 
Thus, claim 1 9 recites that a path expression is extracted from a query and that 
access rights are decided based on this path expression. In contrast, Deo 
relies on a look up table, and Damiani relies on accessing the requested file. 
Neither reference singly, or in combination, teach or suggest a way to make 
access decisions based on information from the query itself without accessing 
the requested document or checking the identity of the requestor in a lookup 
table. 

For these reasons Applicants respectfully submit that Claim 19 is not 
rendered obvious by Damiani in view of Deo. 

Claims 1-5, 7, 11-12, 15 and 17-18 were rejected under 35 U.S.C. 103(a) 
as being unpatentable over Damiani in view of Deo and Murata. The Damiani 
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and Deo references were discussed above. The Murata reference proposes an 
extension of underlying alphabets which represent conditions on nodes in XML 
documents. Murata does not teach or suggest that its teachings may be 
applied to the field of access control systems. More particularly, Murata does 
not teach that a decision regarding access rights to a data file in a database be 
made without accessing the data file nor that the decision be made based on 
path expressions. 

Claim 1 has been amended to include the limitations of Claims 4 and 5. 
Thus, claim 1 recites that a path expression is extracted from a query and that 
access rights are decided based on this path expression. In contrast, Deo 
relies on a look up table, and Damiani relies on accessing the requested file. 
Murata does not teach access control at all. None of the references singly, or in 
combination, teach or suggest a way to make access decisions based on 
information from the query itself without accessing the requested document or 
checking the identity of the requestor in a lookup table. 

For these reasons, Claims 1 and 2-3, dependent thereon, are patentable 
under 35 USC 103(a). 

Claim 7 is dependent on Claim 6 and is patentable over Diamiani and 
Deo for the reasons discussed above. The Murata reference, as discussed 
above, does not teach deciding access rights as claimed. Hence, Claim 7 is 
patentable under 35 USC 103(a). 

Claim 1 1 is dependent on Claim 10 and is patentable over Diamiani and 
Deo for the reasons discussed above. The Murata reference, as discussed 
above, does not teach deciding access rights, as claimed. Hence, Claim 1 1 
and Claim 12, dependent thereon, is patentable under 35 USC 103(a). 
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Claim 1 5 has been amended to recite: 

" , the path expression being derived from a received query ;" 

" , and issuing a decision allowing access or not allowing access to said 
database ." 

Thus, claim 15 recites that a path expression is extracted from a guery. In 
contrast, Deo relies on a look up table, and Damiani relies on accessing the 
reguested file. Murata does not teach access control at all. None of the 
references singly, or in combination, teach or suggest a way to make access 
decisions based on information from the query itself without accessing the 
requested document or checking the identity of the requestor in a lookup table. 
Claim 15 is thus patentable under 35 USC 103(a). 

Claim 17 has been amended to include the limitations of Claim 18. 
Thus, claim 1 7 recites that a path expression is extracted from a query and that 
access rights are decided based on this path expression. In contrast, Deo 
relies on a look up table, and Damiani relies on accessing the requested file. 
Neither reference singly, or in combination, teach or suggest a way to make 
access decisions based on information from the query itself without accessing 
the requested document or checking the identity of the requestor in a lookup 
table. Murata does not teach access control. For these reasons Applicants 
respectfully submit that Claim 17 is not rendered obvious by Damiani in view of 
Deo and Murata. 

CONCLUSION 
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Reconsideration and withdrawal of the rejections with respect to all 
remaining is requested. Applicants submit that the claims are now in condition 
for allowance. 

In the event the Examiner wishes to discuss any aspect of this response, 
please contact the attorney at the telephone number identified below. 

The Commissioner is hereby authorized to charge payment of any fees 
associated with this communication or credit any overpayment to Deposit 
Account No. 090441 . 

Respectfully submitted, 

Dated: March 5, 2009 By: /Donald L. Wenskav/ 

Donald L. Wenskay 

Attorney Registration No. 32661 
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